Examkin

Soru

Zorluk: OrtaCentralized Monitoring, Logging, and Auditing Solutions

An enterprise is designing a centralized logging solution to aggregate VPC Flow Logs from 80 member accounts in an AWS Organization. A solutions architect is tasking with configuring the delivery of these flow logs to a single Amazon S3 bucket located in a dedicated Security account. The S3 bucket must be encrypted at rest. Which TWO of the following configurations are required to ensure the flow logs can be successfully delivered to the centralized S3 bucket?

  1. Configure the Amazon S3 bucket policy in the Security account to allow s3:PutObject and s3:GetBucketAcl actions for the delivery.logs.amazonaws.com service principal.Cevap
  2. Encrypt the Amazon S3 bucket using a Customer Managed Key (CMK) in AWS KMS, and update the KMS key policy to allow the delivery.logs.amazonaws.com service principal to use the key.Cevap
  3. C
    Encrypt the S3 bucket using the default AWS managed KMS key (aws/s3) and configure the key policy to grant cross-account permissions to the member accounts.
  4. D
    Configure a Service Control Policy (SCP) at the organization root that explicitly allows the s3:PutObject permission on the Security account S3 bucket for all member accounts.
  5. E
    Configure the destination S3 bucket policy to grant s3:PutObject permissions to the individual IAM roles used by the instances in the member accounts.

Cevap

Configure the destination S3 bucket policy to allow permissions for the delivery.logs.amazonaws.com service principal, and encrypt the bucket using a Customer Managed Key in AWS KMS with a key policy that allows the delivery.logs.amazonaws.com service principal to use the key.
For cross-account VPC Flow Logs delivery, the S3 bucket policy must allow the delivery.logs.amazonaws.com service principal to perform s3:PutObject and s3:GetBucketAcl actions. Furthermore, if the bucket is encrypted, a Customer Managed Key must be used because AWS managed KMS keys cannot be configured with custom policies to allow service principal access.

Adım Adım Çözüm

1
Configure S3 bucket policy permissions for log delivery
The S3 bucket in the Security account now accepts writes from the VPC Flow Logs delivery service.
Since VPC Flow Logs are delivered via a service principal rather than IAM roles, the bucket policy must explicitly permit the delivery.logs.amazonaws.com principal.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS
A CMK is created with a key policy allowing the delivery.logs.amazonaws.com service principal to perform kms:GenerateDataKey*.
AWS-managed KMS keys do not support key policy modifications and cannot be shared. A Customer Managed Key is required to permit the cross-account log delivery service to write encrypted data to the bucket.

Anahtar Kavram

Centralized VPC Flow Logs delivery to a cross-account S3 bucket requires configuring the bucket policy and KMS key policy to permit the log delivery service principal.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Centralized Monitoring, Logging, and Auditing Solutions

Bu konudan daha fazla soru